Privacy notice

Who is responsible

When you book a time with a business, that business decides what your details are used for, and is the controller of your data. We run the booking system on its behalf, as a processor, under a written agreement with it.

When you have a staff account, we are the controller of the account's details.

• Operator: Sivuu, business ID 3642523-8
• Email: info@sivuu.fi

If you book a time

We hold what you enter and what the booking needs:

• your name, email address and phone number
• the services, time and staff member you booked, and the note you write
• whether you'd like offers from the business
• the emails we send you about the booking, and whether they arrived
• changes and cancellations, and who made them

The business's staff can see your bookings and may add notes of their own, such as what you prefer.

Your details are used to make and look after the booking: the confirmation, the reminder, news of any change, and the link in the email that lets you change or cancel it. The business uses them on the basis of the booking, which is an agreement between you and it, and for offers only if you said yes.

If you have a staff account

• your name, email address, and phone number if you add one
• your password, which the sign-in provider stores only as a one-way hash
• your role, working hours and time off in the business
• a log of the changes you make to bookings, clients, services and settings, so the team can see who did what

We use these to give you access and keep the account safe, on the basis of our agreement with you or the business you work for.

Security and technical data

To stop abuse, such as someone guessing passwords or filling a calendar with fake bookings, we count attempts per IP address, and for bookings also per email address and phone number. The counts delete themselves within 24 hours.

Our hosting handles every request and keeps short-lived technical logs, including IP addresses, to run and protect the service.

The basis is our legitimate interest in keeping the service secure.

Cookies

We use only the cookies the service needs to work: for staff, the ones that keep you signed in, and one that remembers which business you have open. The booking form sets no cookies. There are no analytics or advertising cookies, so there's nothing to consent to.

Who else handles the data

We use these providers. Each handles data only on our instructions, under a data processing agreement:

• Cloudflare: hosting and network. Requests pass through its servers around the world.
• Supabase: the database and staff sign-in. Data is stored in Stockholm, Sweden.
• Resend: sending email, EU region.
• Upstash: the abuse-prevention counts, EU region.

All four are US companies. Where data may be reached from outside the EU, it's protected by the EU standard contractual clauses in their agreements, or by the EU–US Data Privacy Framework.

We don't sell personal data, and don't share it with anyone else unless the law requires it.

How long we keep it

• Bookings and client details: until the business deletes them or asks us to, or stops using the service. Then we delete them within 30 days.
• Staff accounts: until the account is deleted. Deleting it in the app removes it at once, along with any business that person was the only owner of.
• Abuse-prevention counts: 24 hours at most.
• Backups: deleted data is gone from them within 7 days too.

Your rights

You can ask to see the data held about you, to have it corrected or deleted, to restrict or object to its use, and to get it in a portable format.

For a booking, the quickest way is to ask the business you booked with. You can also write to us at info@sivuu.fi: we'll pass the request on and help the business answer it. Requests are answered within a month.

If you think your data is handled wrongly, you can complain to the Data Protection Ombudsman in Finland (tietosuoja.fi).

Changes

If this notice changes, the date at the top changes. We tell businesses using the service about any change that matters by email.